Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability
- Fahim Reza Divi Contact Form 7
- Cross-site scripting (XSS)
- CVSS 7.4 High
Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview
- its-a-feature Mythic
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name
- Axigen Mail Server
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
- themifyme Themify Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
- CVSS 7.2 High
Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
- Independent Analytics Pro
- Cross-site scripting (XSS)
- CVSS 7.2 High
easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
- wpdevteam easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
- CVSS 7.2 High
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
- wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
- tigroumeow Meow Gallery
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header
- Like Button Rating ♥ LikeBtn
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
- codepeople CP Multi View Events Calendar
- Cross-site scripting (XSS)
- CVSS 8.1 High
myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management
- myTinyWMS
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Frappe LMS has Stored XSS in Course Meta
- frappe lms
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability
- bPlugins Media Player Addons for Elementor – Media Player widget for WP
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Stored XSS via crafted URLs in HTML ticket content in Request Tracker
- Best Practical Solutions Request Tracker
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Stored XSS via related ticket subject on RTIR Split and Create Incident forms
- Best Practical Solutions RT for Incident Response
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Stored XSS via HTML scrubber rule in RTIR
- Best Practical Solutions RT for Incident Response
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability
- Liquid Web / StellarWP The Events Calendar
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability
- Crocoblock JetFormBuilder
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Collabora Online: Reflected HTML injection through host_session_id
- online
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress The Events Calendar plugin <= 6.18.2 - Cross Site Scripting (XSS) vulnerability
- Liquid Web / StellarWP The Events Calendar
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability
- Creative Themes Blocksy Companion
- Cross-site scripting (XSS)
- CVSS 8.9 High
Chamilo LMS: Stored XSS in public user-profile fields
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php
- Netsweeper
- Cross-site scripting (XSS)
- CVSS 9.9 CriticalCritical · CVSS 9+
SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
- socfortress CoPilot
- Cross-site scripting (XSS)
- Information disclosure
- CVSS 8.5 High
Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
- ManageEngine SharePoint Manager Plus
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored XSS in Protectel
- ARKETEAM PROTECTELMAJ
- ARKETEAM BDF
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
- phpMyAdmin
- Cross-site scripting (XSS)
- CVSS 8.7 High
Cross-Site Scripting (XSS) in Firebase Auth Handler via Malicious Bundle ID
- Google Cloud Identity Platform and Firebase Authentication
- Cross-site scripting (XSS)
- CVSS 7.2 High
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie
- wpscripts Food Store – Online Food Delivery & Pickup
- Cross-site scripting (XSS)
- CVSS 7.2 High
Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values
- Gravity Forms
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
- Firelight Lightbox
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
- Joinchat
- Cross-site scripting (XSS)
- CVSS 8.8 High
WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
- WP Visitor Statistics (Real Time Traffic)
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
- User Frontend
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute
- liedekef Events Made Easy
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter
- coolplugins Cool FormKit Lite – Advanced Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
MathJax: LaTeX for Drupal - Critical - Cross site scripting - SA-CONTRIB-2026-195
- MathJax: LaTeX for Drupal
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Leaflet - Moderately critical - Cross site scripting - SA-CONTRIB-2026-204
- Drupal Leaflet
- Cross-site scripting (XSS)
- CVSS 3.8 Low
Menu Link Attributes - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-209
- Drupal Menu Link Attributes
- Cross-site scripting (XSS)
- CVSS 3.1 Low
Country - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-211
- Drupal Country
- Cross-site scripting (XSS)
-
Gin Admin Theme - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-219
- Drupal Gin Admin Theme
- Cross-site scripting (XSS)
-
UI Icons - Critical - Cross site scripting - SA-CONTRIB-2026-221
- Drupal UI Icons
- Cross-site scripting (XSS)
-
Zero Point - Critical - Cross-site scripting - SA-CONTRIB-2026-222
- Drupal Zero Point
- Cross-site scripting (XSS)
-
Black Hole - Critical - Cross-site scripting - SA-CONTRIB-2026-223
- Drupal Black Hole
- Cross-site scripting (XSS)
-
ABC - Critical - Cross-site scripting - SA-CONTRIB-2026-224
- Drupal ABC
- Cross-site scripting (XSS)
-
CSV Field - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-226
- Drupal CSV Field
- Cross-site scripting (XSS)
-
Swiper formatter - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-228
- Drupal Swiper formatter
- Cross-site scripting (XSS)
-
UI Icons - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-230
- Drupal UI Icons
- Cross-site scripting (XSS)
-
Block Attributes - Moderately critical - Cross site Scripting - SA-CONTRIB-2026-232
- Drupal Block Attributes
- Cross-site scripting (XSS)
-
USWDS Paragraph Components - Moderately critical - Cross site scripting - SA-CONTRIB-2026-234
- Drupal USWDS Paragraph Components
- Cross-site scripting (XSS)
-
Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236
- Drupal Bootstrap
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250
- Drupal Data field
- Cross-site scripting (XSS)
-
Commerce Stripe - Moderately critical - Cross site scripting - SA-CONTRIB-2026-265
- Drupal Commerce Stripe
- Cross-site scripting (XSS)
-
AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-266
- Drupal AI (Artificial Intelligence)
- Cross-site scripting (XSS)